How to Create a Password That Actually Resists Cracking
P@ssw0rd! satisfies every complexity rule and falls in under a second. Here is what actually makes a password hard to break.
Password rules taught in the 2000s — one capital, one number, one symbol — were designed for humans guessing, not for GPUs. Attackers do not guess; they run wordlists and substitution rules against leaked hashes at billions of attempts per second.
What makes a password hard
Entropy: the number of possibilities an attacker must try. Entropy comes from length and unpredictability, not from decoration. A 16-character random string from a 90-character alphabet has around 104 bits of entropy and is out of reach. P@ssw0rd! has almost none, because every substitution it uses is in every cracking ruleset.
Two workable strategies
Generated random strings. Use the password generator — it draws from the browser's cryptographic random source, not Math.random() — set 16+ characters, and store the result in a password manager. You never type it, so its unreadability is irrelevant.
Passphrases. Four or five random words — copper-hinge-marble-yodel — give strong entropy and remain typeable. This is the right choice for the handful of passwords you must memorise: the device login and the password manager's master password.
The rules that matter more than composition
- Never reuse. Credential stuffing — replaying a leaked pair against other sites — is the most common account takeover by a wide margin.
- Turn on two-factor authentication. An app-based code or a hardware key defeats a stolen password. SMS is weak but far better than nothing.
- Protect email first. Every other account resets through it.
- Change on breach, not on schedule. Forced rotation produces
Summer2026!→Autumn2026!. Change when there is a reason.
Storage
A password manager is the enabling technology for all of the above; without one, reuse is inevitable. Its master password should be a long passphrase, and its recovery kit should be printed and kept offline.
Generating safely
Generation must happen locally. A password produced by a server has been transmitted, logged perhaps, and is no longer exclusively yours. The Data Wave Cloud generator runs entirely in the browser and shows a live strength estimate so you can see what each extra character buys.
FAQ
How long should a password be? 16 characters generated, or 4–5 random words as a passphrase.
Are symbols required? Helpful but secondary — length contributes far more entropy.
Is a browser's built-in manager good enough? Yes for most people, provided the account itself has two-factor authentication.
Keep reading
- 10 Free Online Tools That Save You Time Every DayTen browser tools that quietly remove the small friction from your working day - from merging PDFs to converting units without opening a single app.
- How To Compress PDF Files OnlineA practical guide to shrinking PDFs for email and upload limits - what actually makes a PDF large, and how to reduce it without ruining quality.
- Best Productivity Tools For Remote WorkersThe remote work stack that actually helps: focus systems, lightweight utilities and the habits that stop a home office turning into a slow office.